do not allow blank credentials